Privacy and Consent Policies

This privacy document applies to the Campus Wellness services at University of Waterloo.

At UWaterloo, personal information, including personal health information, is collected, used, and disclosed in a manner consistent with provincial legislation, such as the Freedom of Information and Protection of Privacy Act (FIPPA), R.S.O. 1990 and the Personal Health Information Protection Act (PHIPA), 2004.

Personal health information means identifying information about an individual in oral or recorded form if the information:

1. relates to the physical or mental health of the individual (including information that consists of the health history of the individual’s family),

2. relates to the providing of health care to the individual (including the identification of a person as a provider of health care to the individual),

3. relates to payments or eligibility for health care or coverage for health care in respect of the individual,

4. is an individual’s health number,

5. identifies an individual’s substitute decision-maker, or

6. any other information about an individual that is included in a record containing personal health information that is maintained for the purpose of providing care or health services.

PHIPA imposes certain obligations regarding the collection, use, disclosure, protection and destruction of personal health information, and provides certain rights to the individual to whom the personal health information relates. This Privacy Statement describes our privacy practices with respect to those obligations and tells you how you can exercise your rights.

Implied consent to collect, use, and disclose your information

When you seek services from Campus Wellness, we assume that we have your permission to collect, use, and disclose your personal health information among individuals who provide or assist in providing health care to you. This is called implied consent. The ability to access, use and disclose your personal health information is necessary to deliver coordinated and timely care, as well as to ensure the effective and efficient operation of the services provided.

Once collected, your personal health information is stored securely by UWaterloo in an Electronic Health Record. Your personal health information is accessed by health care providers and those who assist them on a need-to-know basis when it is reasonably necessary to provide health care to you at UWaterloo. Those who access personal health information about you must abide by applicable provisions of Ontario privacy legislation; UWaterloo privacy, confidentiality and security of information policies; as well as relevant professional Colleges, Associations, and other regulatory bodies.

Personal health information in your UWaterloo Electronic Health Record can be accessed by any health care providers at Campus Wellness who provide direct care to you or who may be consulted as necessary in the provision of your care. Personal health information in your UWaterloo Electronic Health Record may also be accessed by support staff to perform administrative services on behalf of health care providers, such as scheduling appointments, facilitating referrals, and managing information security.

PHIPA also permits healthcare providers at Campus Wellness to disclose your personal health information to other health care providers outside of Campus Wellness (e.g., your family physician) so they can provide ongoing and follow-up care. When such a disclosure is made, legislative requirements within PHIPA are followed.

If you do not wish to provide your implied consent to the collection, use or disclosure of your personal health information as set out above, you should let us know. This can be done when you sign the Personal Health Information and Privacy Consent Form at Campus Wellness. You are also free to withdraw consent at any time for the collection, use, or disclosure of your personal health information by providing notice to us.

If you do not provide consent, or if you withdraw consent, a notation will be made in your Electronic Health Record. If the personal health information we can disclosure to other healthcare providers is limited, we are required to inform the recipient when the information is incomplete if the missing information is reasonably necessary for the provision of your health care or assisting in the provision of your health care.

Note that any restrictions that you place on your personal health information do not apply to uses or disclosures required by law, professional or institutional practice, or when disclosure of that personal health information is necessary for the purpose of eliminating or reducing a significant risk of serious bodily harm to an individual or group of persons.

Express consent to disclose your information

Unless you provide express consent, or it is otherwise required by law, your personal health information in your UWaterloo Electronic Health Record will not be disclosed by Campus Wellness to people who do not provide you with health care, for example:

• your insurance company or your employer;

• a healthcare professional for reasons other than providing you with health care;

• your academic advisors, professors, university administration, family or friends.

In cases where you would like us to disclose your personal health information to others, your express consent is required. This may be obtained verbally, in writing, or by electronic means.

Exceptions to consent requirements

There are certain situations where personal health information can be used or disclosed without either express or implied consent. Campus Wellness may use and/or disclose some of your personal health information without consent in a number of situations including the following:

• In order to eliminate or reduce a significant risk of serious bodily harm to a person or group of persons or in compelling circumstances affecting the health or safety of an individual;

• When there are reasonable grounds to suspect that a child (under age 16) or a resident of a long-term care home is or may be in need of protection;

• We may also report when there are reasonable grounds to suspect that a person age 16 or 17 years old is or may be in need of protection;

• For the purpose of a legal proceeding or complying with a court order, or for the purpose of administration and enforcement of various Acts by professional Colleges, Associations, and other regulatory bodies;

• To report sexual abuse by a regulated health professional/regulated professional;

• To process payments through government programs, like the Ontario Health Insurance Plan (OHIP);

• To report certain information, such as a health condition that makes you unfit to drive or to report certain diseases to public health authorities;

• To identify a person who has died;

• To give the spouse or child of the person who has died personal health information to assist them in making decisions about their own care;

• To give information to certain registries or planning bodies that use personal health information to improve health care services or health system management, as long as strict privacy protections are in place;

• To assist health researchers for research, as long as strict privacy requirements are met;

• To improve or maintain the quality of care or the quality of any related program or service offered by UWaterloo Campus Wellness;

• For risk management and legal purposes;

• To allocate resources to our programs and services;

• To assess a person’s ability to make healthcare and other important decisions;

Disclosure of personal health information when your consent is not required is referenced in Your Health Information and Your Privacy in Our Office (PDF) and occurs in accordance with the following guidelines: Practice Tool for Exercising Discretion: Emergency Disclosure of Personal Information by Universities, Colleges and other Education Institutions (PDF) and Fact Sheet: Disclosure of Information Permitted in Emergency or other Urgent Circumstances (PDF).

In addition to the personal health information contained within your UWaterloo Electronic Health Record, when you access services at Campus Wellness, your name is entered into our computerized schedule, which is accessible to authorized individuals from Campus Wellness. This system is password protected and is located on a password-protected network.

Marketing

The law protects you by making sure your personal health information is never shared for marketing purposes unless you expressly consent.

Fundraising

Campus Wellness may collect, use, or disclose personal health information for fundraising if you expressly consent. However, if the information provided consists only of your name and mailing address, your implied consent can be inferred provided that:

• Fundraising is for charitable or philanthropic purposes related to Campus Wellness;

• Campus Wellness has provided, or has made available to you (at the time of receiving health care) notice of the intention to use or disclose the personal health information for fundraising purposes, along with information on how you can easily opt out;

• You had not opted out within 60 days from the time the notice had been provided to you;

• Solicitations contain an easy opt-out from any further solicitations; and

• No solicitations contain information about your health care or state of health.

Research

From time to time, Campus Wellness may be involved in research projects designed to improve our service and may invite you to consider participating. In such instances, it is our practice to follow guidelines adopted by the professional organizations to which researchers belong. These guidelines could include the Canadian Code of Ethics for Psychologists (PDF) (Canadian Psychological Association, 2000), the Code of Ethics and Standards of Practice Handbook (PDF) (2023) for the Ontario College of Social Workers and Social Service Workers, and Ethics in Research with Human Participants (American Psychological Association, 2000).

In addition, we abide by the guidelines for research involving human participants established by the Office of Research Ethics (ORE) at UWaterloo. Any human research must first be reviewed and receive ethics clearance by either the ORE or the UWaterloo Human Research Ethics Committee. Their review involves a number of factors, including determining whether adequate safeguards are in place to protect the privacy of individuals and the confidentiality of their personal health information.

When research involves collection of information through interviews, focus groups, questionnaires, and surveys, your consent is required. However, when research involves analysis of previously collected personal health information consent may not be required. In cases where your consent may not be required, additional requirements as outlined in PHIPA are followed. For example, researchers shall use your personal health information only for the purpose set out in a research plan and agreement, not publish information in a form that could identify you, and not contact you unless you have said they can. If you are invited to participate in research, you should keep in mind that it is voluntary. Your decision to take part or not take part in research will have no impact on the health care services you receive from us.

Evaluation and planning

Campus Wellness is continually seeking to improve the quality of services offered to students, staff, and faculty at UWaterloo. To help us improve, we invite feedback, both orally and/or in writing, from those who access our services. Any information gathered, including ratings and/or written comments, is used only for administrative, statistical, or report-writing purposes. At no time will identifying personal health information be used, shared, or given out.

We have taken the following steps to ensure that your personal health information is secure and protected against theft, loss, unauthorized use or disclosure and unauthorized copying, modification or disposal:

• Paper records containing personal health information are secured in a locked or restricted area.

• Electronic records containing personal health information are located on a password-protected network and are accessed on hardware (e.g., computer, laptop, cell phone, USB flash drive) that is password protected, under supervision and/or secured in a locked or restricted area. All mobile device (e.g., laptop, cell phone, USB flash drive) containing personal health information are encrypted.

• The transfer or transport of paper or electronic records containing personal health information is conducted via secure means.

• Each staff member and Independent Contractor in Campus Wellness is trained to collect, use and disclose personal health information only as necessary to fulfil their duties and in accordance with privacy legislation.

• Each staff member and Independent Contractor must sign the Campus Wellness Confidentiality Agreement prior to being given access to any personal health information.

• In the event of any unauthorized use or disclosure of personal health information: individuals will be informed at the first reasonable opportunity, a note will be made in the individual’s record of personal health information.

• To ensure staff compliance with these privacy guidelines, Campus Wellness conducts audits of our Electronic Health Record and reports any breaches to the Privacy Commissioner (IPC).

• Personal health information is protected in accordance with:

  • Campus Wellness guidelines, for example: Personal Information and Privacy: Guidelines for Working Outside the Office (PDF).

  • UWaterloo policies and guidelines, for example: Policy 46 - Information Management.

  • Information and Privacy Commissioner Ontario guidelines and requirements, for example: Guidelines for Protecting the Privacy and Confidentiality of Personal Information When Working Outside the Office (PDF), Fact Sheet: Encrypting Personal Health Information on Mobile Devices (PDF), and Fact Sheet: Health-Care Requirement for Strong Encryption (PDF).

To determine how long to keep your personal health information, each service at Campus Wellness follows the guidelines established by the various professional organizations to which clinicians belong, as well as according to UWaterloo guidelines: Policy 46 – Information Management and UWaterloo Information and Privacy. Unless otherwise required by law, Campus Wellness keeps records in accordance with the longest applicable retention requirements.

We destroy confidential paper files and electronic information securely according to UWaterloo guidelines (confidential shredding and media disposal) as well as according to guidelines set out by the Information and Privacy Commissioner Ontario (Fact Sheet: Secure Destruction of Personal Information (PDF).

Accessing your information

You have the right to access and receive a copy of the personal health information that Campus Wellness holds about you. Upon written request and confirmation of identity, Campus Wellness will follow requirements for access as outlined within PHIPA and in accordance with UWaterloo guidelines and policies. We may charge a nominal fee to cover the costs of retrieving the documentation and producing a copy.

There may be situations where we are unable to provide you with access to some or all of the information contained in your UWaterloo Electronic Health Record. For example, if it contains personal health information that relates to another individual or if disclosure of the personal health information could reasonably be expected to result in a risk of serious harm to the treatment or recovery of yourself or a risk of serious bodily harm to yourself or another person.

We will respond to your request for access to your record as soon as possible. If we are not able to respond within 30 days, we will contact you and let you know in writing the reason for the delay. If we cannot give you access for reasons such as those outlined above, we will notify you within 30 days, if possible. A written notice will explain why we cannot give you access to some or all of your record.

Correcting your record

If you believe that your UWaterloo Electronic Health Record contains personal health information that is inaccurate or incomplete, you have the right to ask for it to be corrected. A written request showing how our files are inaccurate or incomplete is often required. We will respond to your request as soon as possible. If we are not able to respond within 30 days, we will contact you and let you know in writing the reason for the delay.

Note that requests for corrections apply to factual information and not to any professional opinions or observations made in good faith. We are obligated to correct personal health information where it is demonstrated, to our satisfaction, that the record is in fact inaccurate or incomplete and where the necessary information to correct the record is provided. Any changes will be done carefully so the original record remains visible or by ensuring that the corrected version is readily available.

If we cannot make the requested correction, we will let you know the reason. If you choose, you can attach a statement of disagreement to your record indicating any correction you requested that was not made. You can also ask to have this statement made available to those who access the record or to whom the record is disclosed.

If you have any questions or concerns, or if you would like to see or correct any of your personal health information, please speak directly to the staff person who has been involved in the provision of your care. We want to resolve concerns directly with you.

UWaterloo privacy contact persons

If you are not satisfied with the response to your request, you may contact either of the Privacy Contact Persons designated for Campus Wellness. These individuals are available to assist you with any concerns or decisions regarding privacy.

[insert names/contact information]

UWaterloo Privacy Office

If we are unable to resolve your concerns about how your personal health information has been handled, you may choose to contact the UWaterloo Privacy Office at fippa@uwaterloo.ca.

The Information and Privacy Commissioner of Ontario

Alternatively, or in the event the UWaterloo Privacy Office is unable to address your concerns, you can contact the Information and Privacy Commissioner of Ontario. The Commissioner is the person who has general responsibility for ensuring requirements of the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of Privacy Act, and PHIPA are followed.

You can contact the Commissioner about any decision, action or inaction that you believe is not in compliance with any of the above-noted Acts, including:

• if you are unable to resolve with us a concern about how your personal health information has been handled;

• if you are unable to access all of your personal health information, or have concerns about a delay in responding to your request;

• if you feel your personal health information in your record is incorrect and we have not completed your requested correction; or

• if you disagree with the fee that we charged to see or get a copy of your personal health information.

Typically, concerns must be submitted to the Commissioner within a specified timeframe. If you have a right to complain or appeal a decision we have made, our written decision will include information regarding the deadline. Otherwise, please refer to the Commissioner’s website for more information: Homepage .

UWaterloo Privacy Office

• fippa@uwaterloo.ca 

Information and Privacy Commissioner of Ontario

2 Bloor Street East, Suite 1400
Toronto, Ontario M4W 1A8

Visit the Information and Privacy Commissioner of Ontario website.   

Phone: 416-326-3333
Toll-free: 1-800-387-0073 (within Ontario)
Text Tel. (TTY)/Tel. Device for the Deaf (TDD): 416-325-7539
Fax: 416-325-9195
Email: info@ipc.on.ca

This document provides general information only and is not legal advice as to all rights and obligations under Ontario legislation.

This document is based on the following legislation:

• Freedom of Information and Protection of Privacy Act (R.S.O. 1990)

• Municipal Freedom of Information and Protection of Privacy Act (R.S.O. 1990)

• Personal Health Information Protection Act (2004)

• Personal Information Protection and Electronic Documents Act (PIPEDA, 2004)

In conjunction with materials from the Information and Privacy Commissioner Ontario:

• Information and Privacy
  Information and Privacy Commissioner Ontario (2005). Your Health Information and Your Privacy (PDF)

  Information and Privacy Commissioner Ontario (2015). Frequently Asked Questions: Personal Health Information Protection Act (PDF)

• Working Outside the Office
  Information and Privacy Commissioner Ontario (1998). Privacy and Confidentiality When Working Outside the Office

  Information and Privacy Commissioner Ontario (2001). Guidelines for Protecting the Privacy and Confidentiality of Personal Information When Working Outside the Office (PDF)

• Security of Personal Health Information
  Information and Privacy Commissioner Ontario (2007). Fact Sheet: Encrypting Personal Health Information on Mobile Devices (PDF)

  Information and Privacy Commissioner Ontario (2010). Fact Sheet: Health-Care Requirement for Strong Encryption (PDF)

  Information and Privacy Commissioner Ontario (2012). Fact Sheet: The Secure Transfer of Personal Health Information (PDF)

• Disclosure of Personal Health Information
  Information and Privacy Commissioner Ontario (2018). What to do When Faced with a Privacy Breach: Guidelines for the Health Sector(PDF)

  Information and Privacy Commissioner Ontario (2008). Practice Tool for Exercising Discretion: Emergency Disclosure of Personal Information by Universities, Colleges, and other Educational Institutions (PDF)

  Information and Privacy Commissioner Ontario (2005). Fact Sheet: Disclosure of Information Permitted in Emergency or Other Urgent Circumstance (PDF)

• Destruction of Personal Health Information
  Information and Privacy Commissioner Ontario (2005). Fact Sheet: Secure Destruction of Personal Information (PDF)

uWaterloo guidelines and policies:

• General Information and Privacy

• Security of personal health information: Policy 46 - Information Management

• Record retention and destruction of personal health information: Policy 46 - Information Management

• Confidential shredding procedures

• Electronic media disposal guidelines

And in conjunction with other relevant materials, such as:

• American Psychological Association (2000). Ethics in Research with Human Participants.

• Canadian Psychological Association (2000). Canadian Code of Ethics for Psychologists.

• Canadian Psychological Association (2001). Practice Guidelines for Providers of Psychological Services.

• College of Nurses of Ontario

• College of Physicians and Surgeons of Ontario

• College of Psychologists of Ontario (2005). Standards of Professional Conduct.

• Ontario College of Social Workers and Social Service Workers (2008). Code of Ethics and Standards of Practice Handbook.